A close button: The ad has a close button – the grey ‘X’ in the top right corner. This is not to be confused with the red circle next to it, which has no function and is just part of the rest of the ad.

This ad is usually displayed by adware in the bottom left hand corner of the browser. However, this ad could be displayed by any other means, for example, embedded in a webpage, as a standalone popup, or something else.

What makes this ad exceptionally nefarious is that when you move your mouse over it, another ad appears in a new browser tab. Until recently the ad did not even have the text at the bottom that mentions the “rollover” functionality.

Some examples of this second pop-up ad are shown in figure 2. I have seen a lot of these ads pop-up and they all omit to do two things. The first is they do not tell you that they are an ad. The second is they do not display what program has caused this ad to be shown. The user has no indication that the ad in the new tab would not be there if it was not for the program that displays the first ad, in this case Contoso.

Microsoft considers this behavior as adware and in this case we would detect and remove Contoso. Some of the examples of the second ad that I have seen look like this:

Figure 2: Some examples of the second ad displayed by this adware

As for the second ads, they look like real warnings, but are not. These are advertisements to entice you to download a program which will then offer you more programs to download. I suggest closing the page.